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Printer at play 


Following reports of printer chips infiltrating lragi war 
zones, Dan O’Brien suggests safer ways to amuse your 
machine during its idle moments. Plus, PostScript points. 


When families all over the country 
were being gripped last year by the 
Nintendo footage of the Allied bomb- 
ings of Iraq, programmers communi- 
cating on the international Internet 
mailing system were arguing over the 
evidence for a rather more subtle anti- 
Iraq scheme. The American army, it 
was rumoured, was using viral war- 
fare. Computer viruses, claimed a re- 
port in the US trade paper InfoWorld, 
were being hidden in ‘French printer 
chips’ which, after being exported to 
key Iraqi sites, would emerge to bring 
down entire networks. 

Most of them didn’t believe it; vi- 
Tuses are too difficult to control and 
impossible to target. But the veracity of 
the report quickly became incidental to 
the real interest: howdo you hide some- 
thing like a virus on a printer ‘chip’? 
With most machines, you could face 
some problems. Code hidden in a bog- 
standard dot-matrix would be hard 
pushed to creep the wrong way downa 
Centronics portintoa PC. Smarter print- 
ers connected directly to a network 
might have a better chance: they could 
send fake packets into the network 
stream, perhaps forging system com- 
mands or disk accesses. Examples of 
printers being used to do other things 
than print were solicited from the on- 
line community: maybe they could pro- 
vide clues for a working technique. 
Finally, one person wrote in with his 
experience. He reported seeing a dot- 
matrix printer being programmed to 
sing “Yankee Doodle Dandy’ with its 
print-head. Apparently, someone had 
noticed that printing different charac- 
ters changed the tone of the printer 
noise, and worked it all out from there. 
This month’s Low Level, in the inter- 
ests of good citizenship, doesn’t show 
you how to win wars with your printer, 
and most dot-matrix warranties are void 
following singalongs. Butit should give 


you some idea of what printers, at least 
PostScript ones, can do with their spare 
time. It’s a small program that can be 
run when the printer is idle to calculate 
Mandelbrotset plots. The beautiful (and 
rather familiar) graphics generated can 
either be printed normally in riveting 
laser-printer greyscale or retrieved by 
the PC from the printer, which can send 
its calculated data over a serial port to 
be re-displayed in vibrant, living col- 
our on a monitor. 

Apologies in advance, incidentally, 
if you're already sick to death of bubbly 
little ‘brot plots. There are other matters 
which a work-shy printer can attend to, 
particularly a Level II PostScript printer, 
as we'll see. But plotting fractals has the 
advantage of being a short algorithm 
that’s portable across almost every 
PostScript machine. 

This sort of thing is possible because 
PostScript is a complete, fully-featured 
language. Indeed, as an interpreted lan- 
guage it’s rather better than the BASIC 
supplied with most DOS systems. It is 
stack-based, which means that its source 
code looks largely incomprehensible to 
anyone not brought up on FORTH. It 
also means that is highly optimised for 
interpreted work. Most ofthe commands 
concentrate on producing decent hard- 
copy naturally, but the language has its 
fair complement of general-purpose 
commands too. For some it’s the lan- 
guage of choice, with its pleasantly 
loose but clear-cut approach to variable 
typing, similar to LISP. 

Moreimportantly forus, ifconnected 
to a serial or other bi-directional port 
(like AppleTalk), it can receive mes- 
sages from, and send them to, its con- 
trolling PC. The best way to see this in 
action is to connect the printer to a 
serial port on a PC and run a standard 
terminal program at it (the Terminal 
program in Windows will dofine). Type 
in the short program in Listing 1, and 
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press Return. If your typing is echoed to 
the screen but nothing happens, you 
may have to press Ctrl-D to get things 
moving. If nothing echoes at all, check 
your connections or experiment with 
the settings of your terminal program. 
There may be matters on the front- 
panel of the printer to which you will 
have to attend. 

With a bit of luck, Listing 1 should 
produce a result. If it says ‘Tough!’, 
your luck has run out a little. The pro- 
gram tests to see whether your printer 
has builtina programming utility called 
the ‘executive’. This provides an easier 
way to talk toa PostScript interpreter by 
providing acommand-line prompt simi- 
lar to that in MS-DOS. From this you 
can use PostScript to print the values of 


Listing 1 — test .ps 


HANDS ON - 


L:ObW: SEs Vleck 


variables, write little test procedures 
and generally mess around, just by using 
the terminal program to type commands. 
If you didn’t get the ‘Tough!’ message, 
you should already have seen the ex- 
ecutive welcome page. If you did, don’t 
worry. It makes catching the data sent 
from printer to PC a little tricky, but 
that’s all. 

To give the printer its new instruc- 
tions, type Listing 2 into a text editor, 
then send it using the ASCII upload/ 
send file feature on your terminal pro- 
gram. It will begin running immedi- 
ately: full stops should appear on the 
screen, signalling that the printer is 
busy calculating. You can get on with 
something else now, like typing in the 
QBASIC ‘brot receiver. After you’ve 


/executive where { pop executive } { (Tough luck!) print } 


ifelse 


Listing 2 — mandel .ps 


/InitBrot { 


/xcentre -0.75 def % Default values 


/ycentre 0 def 
/size 2.5 def 


% Change for other 
% Mandelbrot areas 


/infinity 40 def % and details 


/pixwidth 32 def 


% Size of 


/pixheight 20 def % screen (try 320 x 200) 
/aspect 19 26 div % Distort for a 19' x 26' 
% monitor 
pixwidth pixheight div mul def 
/greymult 254 infinity div def 


size 2 div dup 


/xmin exch xcentre exch sub def dup 


/xmax exch xcentre 
/ymin exch ycentre 
/ymax exch ycentre 
/ind 0 def 

}bind def 
/CalcBrot { 
/realpart xmin def 
/imagpart ymin def 
/bitmap pixheight array def 


add def dup 
add aspect div def dup 
exch sub aspect div def pop 


bitmap dup 0 1 pixheight 1 sub { pixwidth string put dup } 


for pop 


/horistep xmax xmin sub pixwidth 1 sub div def 
/vertstep ymax ymin sub pixheight 1 sub div def 
{ % begin forall 


/ourstring exch store 
0 1 pixwidth 1 sub 


{ % begin for 


/ourindex exch store 
/iterations 0 store 
/newreal 0 store 
/newimag 0 store 
/modulus 0 store 

{ 

modulus 4 1t 


% begin loop 


iterations infinity 1t 
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done that, you can return to the termi- 
nal program. With a bit of luck the full 
stops will have stopped, and either a 
little prompt or the beginnings of the 
dump will have begun. Turn the ASCII 
capture/session logging feature of your 
terminal program on. If you’re in the 
executive, type ‘wholedump’. Num- 
bers should now fill your screen (and 
your disk drive): save them to a file 
called TERM.DMP. If you don’t have 
the executive, you'll have to try and 
catch the beginning of this dumping 
manually as it will automatically start 
at the end of the ‘brot calculations. 
The QBASIC receiver should be able 
to untangle anything you half-catch. 

The ‘brot generated is very coarse, 
32 x 20, but it should provide a quick 
return. The PostScript printout will 
scale anything up to fill one printer 
page; the QBASIC converter can han- 
dle anything up to 320 x 200. Neither 
the QBASIC nor the PostScript has 
been particularly optimised, so the 
results are rather slothful, an issue 
very much exacerbated by a slow se- 
rial link. In this case, the program is 
listed to demonstrate the possibility of 
having these two-way conversations 
between machines. It’s not how well 
this dog can dance, but that it can 
dance at all. Calm yourself with the 
thought that all this printer processor 
time would otherwise be wasted on 
idle looping. 


On the level 

One of the minor frustrations of 
PostScript is that the features which 
allow a truly useful exploitation of 
such background processes are only 
available in Level II PostScript. Level 
Il is a selling point for colour printers 
but has filtered rather slowly else- 
where, despite a number of more gen- 
eral extensions to the language. 

Background processing is possible 
in the older PostScript language, as 
we’ve seen, but it’s more fun in Level 
Il. In Level I, for instance, all variables 
from one PostScript program are lost 
when another is downloaded, unless 
you're in executive mode (or, more 
technically, you have learnt to bypass 
the server). So, one can’t easily pro- 
vide for a background process that 
will shut up whenever a real letter 
needs to be printed and then continue 
from where it left off. Level II has an 
additional abbreviation-storage area, 
called ‘globaldict’ (as opposed to the 
temporary stack space of localdict) 
which provides for this. 

More frustratingly, one of the tasks 
best suited for a printer to perform is 
already coded up in a Level II opera- 
tor: data compression and 


an ON -> LOW LEVEL 2 


{ exit } if 
/realsq newreal dup mul store 
/imagsq newimag dup mul store 
/modulus realsq imagsq add store 
/newreal realsq imagsq sub realpart add 
/newimag 2 newreal newimag mul mul 
imagpart add store 


store 
/iterations iterations 1 add store 
} loop % end loop 
iterations infinity ne 
Bye % begin if 


‘ourstring ourindex 
.<iterations greymult mul 1 add cvi 


put 

pie % end if 
/realpart realpart horistep add store 
me Se he % end for 


/imagpart imagpart vertstep add store 
/realpart xmin store 
(.) print flush 


} forall % end forall 
}bind def 

%ShowBrot - dump to PostScript printer 
/ShowBrot { 


clippath pathbbox % find size of PostScript device 
/hy exch def /hx exch def /by exch def /bx exch def 
bx by translate 
hx bx sub hy by sub scale 
pixwidth pixheight 8 [pixwidth 0 0 pixheight 00] 
/ind 0 store { bitmap ind get /ind ind 1 add store } image 
}bind def 
%Routine to dump data to PC via serial port 
%(described as the ‘stdout’ file by Ps) 
/stdout (%stdout) (w) file def % open file 
/linetoPc { 
(+++++++) print stdout exch writehexstring 
(------- \r\n) print flush 
}bind def 
/wholedump { bitmap { linetoPc } forall }bind def 
%main program 
gsave 
InitBrot 
CalcBrot 
ShowBrot 
/executive where {pop} {wholedump} if 
grestore 


Listing 3 — showbrot.bas 


REM SHOWBROT.BAS - Converts data output 
REM by PostScript ‘wholedump’ routine 
REM in 320x200 256 Colour mode 
SCREEN 13 
VIDSEG = &HA000 
DEF SEG = VIDSEG 
OPEN “C:TERM.DMP” FOR INPUT AS #1 
DO 
LINE INPUT #1, AS 
Deer ob 
DO 
WHILE MIDS(A$, I%, 1) <> “+” AND I% <= LEN (AS) 
B% sth 41 
WEND 
WHILE MIDS(A$, I%, 1) = “+” AND I% <= LEN (AS) 
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1% = 
WEND 


I% +1 


HANDS ON > LOW LEVEL a 


WHILE I% <= LEN(A$) AND MID$(A$, I%, 1) <> “-” 


vV% = VAL(”&H” + MIDS(AS, 


I%, 2)) 


IF INKEY$ = “ ” THEN PRINT V%; “&H” + MID$(A$, I%, 2) 


POKE M&, 
I% = 
M& = 


V% 
I% + 2 
M& + 1 


INT((M& - 1) / 320) * 
LOOP UNTIL I% > LEN(A$) 

LOOP UNTIL EOF(1) 

CLOSE #1 


uncompression. Level II includes a fil- 
ter command with a number of built-in 
conversion utilities, in particular the 
very popular LZW compression (as used 
in ZIP, ARC and the Windows NT filing 
system) and JPEG. 

As you may know, JPEG can cuta 24- 
bit colour file to 10% of its size with 
little visible loss of detail. Apart from 
the Alchemy program from Handmade 
software, few readily available JPEG 
compressors for the PC exist yet. It’s 
annoying to know that many users have 
a simple method for cutting down on 
their storage of colour images, without 
using valuable PC processor time, right 
under their noses. 

LZW compression is a more general 
technique that cuts data down, on aver- 
age, to half its length. It is much more 
prevalent on PCs, and therefore much 
easier to do on a PC. Its existence in a 
printer, though, provides a different 
kind of advantage from the JPEG facil- 
ity. If, for example, the ‘brot image data 
could have been compressed using LZW 
before it was sent over the serial lines, 
then uncompressed on the PC, time 
spent sending the data would have been 
saved, making the whole application 
faster and much less of an academic 
exercise. Level I printers can be pro- 
grammed to perform LZW compres- 
sion and decompression, but they have 
to be taught to do so in PostScript, 
which slows things down 
considerably and makes 
the trade-offs less easy to 
ascertain. The PostScript 
driver in Windows 3.1, for 
instance, uses this tech- 
nique with mixed results. 
In many cases, if you have 
a slow printer or a fast se- ot 
rial link, you might want jee 
to keep hold of the Win- 
dows 3.0 driver. 

The report of viruses 
being smuggled via print- 
ers, incidentally, wasn’t 
true: the date of the 
InfoWorld article was 1 
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320 + 320 


April. In the months after it went to 
press, however, many hackers on the 
Internet had already sketched out how 
it could have been done. Truth follow- 
ing fiction? Perhaps we’ll have to wait 
for the next war to find out. 

Alchemy is available from Hand- 
made Software in the US on (0101-408 
358-1292) or viahsi@netcom.COM, CIS: 
71330,3136. 


\PostScript { toread } how 
It’s not difficult to determine the mean- 
ing ofa PostScript program once you’ve 
understood a few basic principles. 
Firstly, as in German, the verb, or ‘op- 
erator’, ofa PostScript command is usu- 
ally at the end of things to which it 
refers. Secondly, words in PostScript 
can be only one of a limited set of 
things. They have to be numbers (which 
look like numbers), strings (always sur- 
rounded by round brackets), arrays [al- 
ways surrounded by square brackets] or 
an operator (like ‘add’ or ‘def’). Any- 
thing else is generally an abbreviation 
(a ‘name’) which can be converted 
quickly to the above. Together, these 
things are called ‘objects’ in PostScript. 
During execution, a PostScript inter- 
preter picks up each object written into 
the program in turn, from the start ofthe 
listing onwards. Everything that isn’t 
an operator is pushed onto the stack. 
Objects pushed onto the stack just sit 


there, waiting for later processing. So 
the PostScript line: 

1 2 (Hello, World!) 
won't, by itself, do anything. Put a 
‘print’ operator next, though, and the 
phrase ‘Hello, World!’ will be printed. 
This is because ‘print’ is an operator 
whose function is to take the object on 
the top of the stack (the last thing 
pushed) and then display it. Most 
operators work on whatever is nearest 
the top of the stack and most ‘pop’, or 
take the object (or objects) they’ve 
used off the stack when they’re done. 
Some operators push results back onto 
the stack: 

1 2 add print 
for example, will first of all push ‘1’ 
and ‘2’ to the stack. Then ‘add’ (an 
operator) will pop the two topmost 
values and add them together. The 
result of this sum will then be pushed 
onto the stack in their place. Finally, 
print will print that result — hope- 
fully, three. 

Things can get more complicated 
with bigger stacks: 

2 100 1 3 add mul div print 
prints ‘200’, because the final result is 
a hundred times 3 and 1 added, di- 
vided by 2. 

Variables and procedures in 
PostScript look the most confusing. 
Remember that they are just abbrevia- 
tions for the simpler objects. 

\fred 32 def 
defines ‘fred’ as an abbreviation for 32 
(the slash is just to stop the interpreter 
looking for an operator or earlier ab- 
breviation when it comes across that 
first fred). Similarly, 

\increment { 1 add } def 
means that ‘increment’ is now an ab- 
breviation for a set of commands that 
adds 1 to whatever is on top of the 
stack. Thecurly brackets, like the slash, 
simply stop the interpreter from try- 
ing to push 1 and execute the add 
operator as soon as they see those 
symbols in the definition. Curly brack- 
ets always delay the execution of the 
objects inside them. Until, 
say, this line: 

fred increment 

print 
which will (if the lines 
above it were read earlier) 
print 33. 
\fred fred 
increment store 
will add one to the value of 
fred, and then replace the 
old value of fred with this 
new one, like 
fred=fred+1 
inamore familiar language. 

This should give you a 

start. 
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